SpringBoot防止大量请求攻击

Posted 2021-12-19 qykhhr

我们使用Jmeter测试同学的网站时，就会出现网站无法访问，403等错误。

An error occurred.
Sorry, the page you are looking for is currently unavailable.
Please try again later.

If you are the system administrator of this resource then you should check the error log for details.

Faithfully yours, nginx.

所以我们需要加上IP访问时间限制，防止一个IP多次访问请求，导致整个网站崩溃。

• 自定义注解：

import java.lang.annotation.ElementType;
import java.lang.annotation.Retention;
import java.lang.annotation.RetentionPolicy;
import java.lang.annotation.Target;

/**
 * 自定义注解，用于拦截过于频繁的请求
 */
@Retention(RetentionPolicy.RUNTIME)
@Target(ElementType.METHOD)
public @interface AccessLimit 
    int seconds();
    int maxCount();
    boolean needLogin() default true;

• 自定义拦截器：
  我采用了抛出自定义异常的方式来解决相同IP多次访问的问题：
  throw new DujiaoshouException(20001,"操作过于频繁");

import com.qykhhr.dujiaoshouservice.exceptionhandler.DujiaoshouException;
import com.qykhhr.dujiaoshouservice.mycomment.AccessLimit;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.data.redis.core.RedisTemplate;
import org.springframework.stereotype.Component;
import org.springframework.web.method.HandlerMethod;
import org.springframework.web.servlet.HandlerInterceptor;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.util.concurrent.TimeUnit;

/**
 * 自定义拦截器
 */
@Component
public class AccessLimtInterceptor implements HandlerInterceptor 

    @Autowired
    private RedisTemplate redisTemplate;

    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception 

        if (handler instanceof HandlerMethod) 
            HandlerMethod hm = (HandlerMethod) handler;
            AccessLimit accessLimit = hm.getMethodAnnotation(AccessLimit.class);
            if (null == accessLimit) 
                return true;
            
            int seconds = accessLimit.seconds();
            int maxCount = accessLimit.maxCount();
            boolean needLogin = accessLimit.needLogin();

            if (needLogin) 
                //判断是否登录
            
            String ip=request.getRemoteAddr();
            String key = request.getServletPath() + ":" + ip ;
            Integer count = (Integer) redisTemplate.opsForValue().get(key);

            if (null == count || -1 == count) 
                redisTemplate.opsForValue().set(key, 1,seconds, TimeUnit.SECONDS);
                return true;
            

            if (count < maxCount) 
                count = count+1;
                redisTemplate.opsForValue().set(key, count,0);
                return true;
            

            //  response 返回 json 请求过于频繁请稍后再试
            throw new DujiaoshouException(20001,"操作过于频繁");
        

        return true;
    

• 在webconfig中配置拦截器

import com.qykhhr.dujiaoshouservice.Interceptor.AccessLimtInterceptor;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
import org.springframework.web.servlet.config.annotation.ResourceHandlerRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurerAdapter;

/**
 * 在webconfig中配置拦截器
 */
@Configuration
public class MyWebMvcConfigurer extends WebMvcConfigurerAdapter 

    @Autowired
    private AccessLimtInterceptor accessLimtInterceptor;

    @Override
    public void addInterceptors(InterceptorRegistry registry) 
        registry.addInterceptor(accessLimtInterceptor);
        super.addInterceptors(registry);
    

• 在Controller前面加上注解就可以生效了

@RestController
public class AppHomeController 

    @GetMapping("/index")
    @AccessLimit(seconds = 1, maxCount = 3) //1秒内 允许请求3次
    public R getImageList()
        return R.ok().data("appHome","hahaha");
    

使用python发送100次请求，可以发现请求被拦截了多少

对于注解，我们也可以不使用它，但是我们需要在拦截器中写入固定的参数。